Whitearmor (emerging ransomware group) 'Project Trojan Horse' - initial access sales and insider recruitment

Key facts for WhiteArmor ransomware group

Detection coverage for WhiteArmor ransomware group

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5190 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WhiteArmor Project Trojan Horse - Okta Session Established After MFA Failure/Push-Deny Burst (Valid Account Takeover)

TL-2026-5190: WhiteArmor's 'Project Trojan Horse' advertises initial access to Okta and other identity platforms. Access brokers and recruited insiders typically reach a working Okta session via valid credentials and MFA fatigue or bypass. This search flags a user who accumulates 3+ MFA failures, push denials or bypass attempts within a 30-minute window and then obtains a successful Okta session (T1078 / T1078.004), the pattern left by a takeover of a corporate identity.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078, T1078.004, T1621
• Data sources: okta:OktaIM2:log, azure:SigninLogs, okta system log
• Severity: high
• Confidence: high

Splunk SPL

index=okta sourcetype="OktaIM2:log" earliest=-24h
    (eventType="user.session.start" OR eventType="user.authentication.auth_via_mfa" OR eventType="user.mfa.okta_verify.deny_push" OR eventType="user.mfa.attempt_bypass")
| eval is_fail=if(eventType IN ("user.mfa.okta_verify.deny_push","user.mfa.attempt_bypass") OR (eventType="user.authentication.auth_via_mfa" AND 'outcome.result'="FAILURE"), 1, 0)
| eval is_success=if(eventType="user.session.start" AND 'outcome.result'="SUCCESS", 1, 0)
| bin _time span=30m
| stats sum(is_fail) AS mfa_fail_or_deny sum(is_success) AS successful_sessions dc(client.geographicalContext.country) AS countries values(client.ipAddress) AS src_ips values(client.userAgent.rawUserAgent) AS user_agents BY _time actor.alternateId
| where mfa_fail_or_deny>=3 AND successful_sessions>=1
| eval threat="TL-2026-5190 WhiteArmor Project Trojan Horse - T1078.004 Okta valid-account takeover"
| sort - mfa_fail_or_deny

Microsoft KQL

let lookback = 24h;
let window = 30m;
// Entra ID ResultTypes: 50074/50076 MFA required, 500121 MFA failed, 50158 external challenge, 50072 MFA enrolment prompt
SigninLogs
| where TimeGenerated > ago(lookback)
| where UserType == "Member"
| extend IsFail = iff(ResultType in ("50074","50076","500121","50158","50072"), 1, 0)
| extend IsSuccess = iff(ResultType == "0", 1, 0)
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize MfaFailures = sum(IsFail), Successes = sum(IsSuccess), Countries = dcount(Country), SourceIPs = make_set(IPAddress, 10), Apps = make_set(AppDisplayName, 10) by UserPrincipalName, bin(TimeGenerated, window)
| where MfaFailures >= 3 and Successes >= 1
| project TimeGenerated, UserPrincipalName, MfaFailures, Successes, Countries, SourceIPs, Apps
| order by MfaFailures desc

Sigma

title: Okta MFA Push Denied or Bypass Attempt - WhiteArmor Valid Account Takeover Precursor
id: 5b0e4a1c-8d3f-4a62-9c71-3f5e2a9d1b01
status: experimental
description: Detects Okta MFA push denials and MFA bypass attempts, the user-visible precursor to session takeover of an Okta identity as advertised in WhiteArmor's Project Trojan Horse (TL-2026-5190). Alert on bursts per user.
references:
    - https://www.ransomware.live/group/whitearmor
    - https://www.ransomware.live/id/UHJvamVjdCBUcm9qYW4gSG9yc2VAV2hpdGVhcm1vcg
    - https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/whitearmor
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial_access
    - attack.credential_access
    - attack.t1078.004
    - attack.t1621
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventtype:
            - 'user.mfa.okta_verify.deny_push'
            - 'user.mfa.attempt_bypass'
    condition: selection
falsepositives:
    - Users who mistakenly deny a legitimate push prompt
    - Users changing phones or re-enrolling authenticators
level: medium

Known false positives:

• Users who mistakenly deny a legitimate push prompt then re-authenticate successfully
• Users on new phones or travelling with poor connectivity who trigger repeated MFA failures
• Automated test accounts or service accounts with scripted authentication

Tuning notes: Raise or lower the threshold of 3 per 30 minutes to suit your baseline. Exclude known service accounts and scripted test users. Enrich with network zone and device-trust fields and prioritise results where the successful session is from a new country or an unmanaged device. Apply stricter handling to privileged and admin-group users.

• 🔒 WhiteArmor Project Trojan Horse - Entra ID Successful Sign-In From a Country Not Seen for the User in 14 Days · unlock with TL Creds
• 🔒 WhiteArmor Project Trojan Horse - Azure Root/Subscription-Scope Role Assignment or Global Admin Access Elevation · unlock with TL Creds
• 🔒 WhiteArmor Insider Recruitment / Data Extortion - Bulk SharePoint and OneDrive File Download by a Single User · unlock with TL Creds
• 🔒 WhiteArmor Project Trojan Horse - FortiGate Admin Login From External IP or VPN Success After Failures · unlock with TL Creds
• 🔒 WhiteArmor Project Trojan Horse - Jenkins Script Console, Plugin Upload or Credential Store Access · unlock with TL Creds
• 🔒 WhiteArmor Crypto-Ransomware Impact Precursor - Shadow Copy, Backup Catalog and Boot Recovery Destruction · unlock with TL Creds
• 🔒 WhiteArmor Project Trojan Horse - Okta Persistence via New MFA Factor, API Token, Admin Grant or Policy Weakening · unlock with TL Creds
• 🔒 WhiteArmor Leak-Site and Access-Broker Contact Infrastructure Access ([indicator], Tor onion, Telegram [indicator]) · unlock with TL Creds

Indicators of compromise for WhiteArmor ransomware group

As of 2026-11-04, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5190.

Sample indicators (2 of 16)

• Domain: whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad[.]onion
• URL: hxxps://www[.]ransomware[.]live/id/UHJvamVjdCBUcm9qYW4gSG9yc2VAV2hpdGVhcm1vcg

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How WhiteArmor ransomware group works

Whitearmor (also written WhiteArmor) is an emerging ransomware and data-extortion group. Trackers date its first claimed victims to 2026-10-20/22 and describe it as a crypto-ransomware operation using direct extortion, double extortion and free data leaks, with ransom demands reported between $140,000 and $20,000,000 payable in BTC or XMR. It operates a Tor leak site and a clearnet site (whitearmor.cc). Trackers report between 11 and 19 victims depending on the snapshot, mainly US-based, with victims also in China, Brazil, Indonesia, Philippines, Germany, Argentina, Iceland and Curacao, concentrated in logistics/transportation, manufacturing, technology, retail and media.

On 2026-11-03 ransomware.live listed a post titled 'Project Trojan Horse' attributed to Whitearmor. The post advertises the sale of initial access to organizations ('working with all kinds of accesses depending on said target'), with a minimum company revenue threshold of $500M and a geographic exclusion of the CIS region. Preferred access types named are identity and cloud platforms (Okta, Azure, IAM Root), CRM tools, the Jenkins CI/CD server, and VPN access (Fortinet, Cisco AnyConnect, Citrix, SonicWall). The group also recruits employees/insiders. ransomware.live lists 12 target sectors: Agriculture, Education, Energy & Utilities, Financial Services, Government & Defense, Healthcare, Hospitality, Manufacturing, Professional Services, Retail & E-Commerce, Technology and Transportation, with specific interest in edtech, enterprise software, insurance, hotels, telecommunications, finance, retail, automotive, transportation and logistics.

This post indicates Whitearmor is moving to broker or buy access (and insider-enabled access) in addition to its own extortion operations, a model that bypasses perimeter exploitation and relies on valid credentials, sessions and trusted-insider actions. No CVEs, malware hashes, C2 IPs or technical TTPs were published by any source reviewed; the MITRE mapping below is limited to behaviors directly evidenced by the advertisement and by tracker descriptions of the group's extortion model. Source discrepancies: contact handles differ between trackers (Telegram @whitearmorsupp per ransomware.live Project Trojan Horse post; @whitearmorxd and X @WhiteArmorxd per WatchGuard), and victim counts and first-seen dates vary by tracker (Oct 20-22, 2026). Single-source for the Project Trojan Horse post itself (ransomware.live). No BeaconBeagle C2 correlation was available (lookup for whitearmor.cc returned HTTP 502; no IP IOCs exist).

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1133 External Remote Services

Persistence

T1078 Valid Accounts; T1133 External Remote Services

Resource Development

T1650 Acquire Access

Impact

T1657 Financial Theft

Remediation for WhiteArmor ransomware group

Patches

• Keep Fortinet, Cisco AnyConnect, Citrix and SonicWall VPN appliances and Jenkins fully patched per vendor advisories

Immediate actions

• Review Okta, Azure/Entra ID and cloud IAM root/privileged account sign-ins for anomalous locations, new devices, MFA changes and token/session reuse
• Audit and rotate credentials and API tokens stored in or reachable from Jenkins and CRM platforms; review Jenkins admin and build-agent access
• Review VPN logs (FortiGate, Cisco AnyConnect, Citrix, SonicWall) for logins from unusual geographies, impossible travel and off-hours access
• Block and alert on the Whitearmor leak-site and contact infrastructure indicators listed in the IOC set

Workarounds

• Restrict VPN and Jenkins management interfaces to allow-listed sources; disable unused remote-access accounts

Longer-term hardening

• Enforce phishing-resistant MFA and conditional access on identity providers, VPNs and privileged cloud roles
• Establish an insider-risk program: privileged access reviews, separation of duties, DLP and user behavior analytics, and a confidential reporting channel for recruitment approaches
• Segment CI/CD infrastructure and enforce least privilege and just-in-time access for IAM root/admin roles
• Monitor infostealer log exposure for corporate domains and force resets for exposed credentials

Affected and fixed versions

• Okta — Okta identity platform
  Vulnerable versions: Not specified - access targeted via accounts/sessions
• Microsoft — Azure / Entra ID
  Vulnerable versions: Not specified - access targeted via accounts/sessions
• Jenkins — Jenkins CI/CD server
  Vulnerable versions: Not specified
• Fortinet — FortiGate VPN
  Vulnerable versions: Not specified
• Cisco — AnyConnect VPN
  Vulnerable versions: Not specified
• Citrix — Citrix remote access
  Vulnerable versions: Not specified
• SonicWall — SonicWall VPN
  Vulnerable versions: Not specified

Timeline of WhiteArmor ransomware group

• 2026-10-21 locked-ioc-12's first victim claim appears on its leak site (ransomware.live estimates 2026-10-21 as first activity; other trackers cite 2026-10-20/22).
• 2026-10-22 locked-ioc-12 claims locked-ioc-6 on its leak site.
• 2026-10-23 ransomware.live registers locked-ioc-12 as a newly discovered emerging ransomware group.
• 2026-10-26 locked-ioc-12 claims responsibility for an attack on locked-ioc-4.
• 2026-10-28 locked-ioc-12 claims locked-ioc-7 and reportedly demands $20M in Bitcoin.
• 2026-10-30 locked-ioc-12 lists locked-ioc-11 (Philippines) as a victim.
• 2026-10-31 locked-ioc-12 lists locked-ioc-15 V2; Breachsense records this period as its most recent victim at that snapshot.
• 2026-11-01 locked-ioc-12 lists locked-ioc-13 (GoDaddy instance) as a victim.
• 2026-11-03 ransomware.live lists the 'Project Trojan Horse' post: initial access sales for >$500M-revenue companies (excl. CIS) and insider recruitment, contact via Telegram locked-ioc-8.

Sources cited for WhiteArmor ransomware group

• ransomware.live - Project Trojan Horse (Whitearmor) ransomware.live · Research · 2026-11-03
• ransomware.live - Whitearmor group profile ransomware.live · Research · 2026-11-03
• WatchGuard Ransomware Tracker - WhiteArmor watchguard.com · Vendor report · 2026-10-28
• Breachsense - WhiteArmor ransomware group breachsense.com · Research · 2026-10-31
• SOCRadar Ransomware Intelligence - Ryder / Whitearmor socradar.io · Research · 2026-10-28
• DeXpose - Whitearmor Ransomware Attack on J.B Hunt dexpose.io · News · 2026-10-26
• DeXpose - Whitearmor Targets Ryder System in Ransomware Attack dexpose.io · News · 2026-10-28
• Cybernews - Hisense faces $5 million ransom demand over alleged 19GB data theft cybernews.com · News · 2026-10-30

More in ransomware

• HHS OCR Settles Ransomware Investigation of Lehigh Valley Health Network (ALPHV/BlackCat)
• 3AM (ThreeAM) Ransomware Hybrid Human/AI-Assisted Attack on UK School Estate
• NCSC Warns of AI-Enabled Ransomware Threat to UK Critical National Infrastructure by 2028 (PHP2Shell CVE-2026-109618/109619 cited)
• Qilin (Agenda) Ransomware Evolution: March vs October 2026 Variants (Forged Code-Signed, Modular, Hypervisor-Targeting)
• Ransomware Targeting of Small and Medium-Sized Businesses: Credential Theft, Unpatched Edge Devices, BYOVD and Backup Targeting

Further reading

• Screensaver (.SCR) Files as Initial Access